Skip to content
Heist/ feed
Back to feed
Medium

Kyverno resource with a deletionTimestamp may allow policy circumvention

Type: advisorySources: OSV

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-34091
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 05:47 UTC · Revision 1

Source evidence

Kyverno resource with a deletionTimestamp may allow policy circumvention

core-osv · Original source

Published 1 Jun 2023, 16:24 UTC

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.

osv:CVE-2023-34091
Complete source record
{
  "id": "8cc94dc4f5b3e90340499ee4fa1a5492668a24d2ff80f7dccfd9486e4a1c58dc",
  "url": "https://osv.dev/vulnerability/CVE-2023-34091",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Kyverno resource with a deletionTimestamp may allow policy circumvention",
    "summary": "Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.",
    "evidence": "osv:CVE-2023-34091",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2023-34091",
      "aliases": [
        "CVE-2023-34091",
        "GHSA-hq4m-4948-64cc",
        "GO-2023-1819"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/kyverno/kyverno",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "da6f5c18132f773af15d0e09cbf2e16a36725232"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.10.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "da6f5c18132f773af15d0e09cbf2e16a36725232"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.10.0"
                  },
                  {
                    "cpe": "cpe:2.3:a:nirmata:kyverno:*:*:*:*:*:go:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.10.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "kyverno-policies-chart-3.0.0-rc.1",
            "v1.10.0-rc.1",
            "kyverno-chart-3.0.0-rc.1",
            "v1.10.0-beta.1",
            "kyverno-policies-chart-3.0.0-beta.1",
            "kyverno-chart-3.0.0-beta.1",
            "v1.10.0-alpha.2",
            "kyverno-policies-chart-3.0.0-alpha.2",
            "kyverno-chart-3.0.0-alpha.2",
            "v1.10.0-alpha.1",
            "kyverno-policies-chart-3.0.0-alpha.1",
            "kyverno-chart-3.0.0-alpha.1",
            "1.9-dev",
            "1.8-dev",
            "1.7-dev",
            "test-dev",
            "1.6-dev",
            "helm-chart-v2.1.3",
            "v1.5.0-rc1",
            "helm-chart-v2.1.0",
            "v1.4.3",
            "helm-chart-v2.0.3",
            "v1.4.3-rc2",
            "helm-chart-v2.0.3-rc2",
            "v1.4.3-rc1",
            "helm-chart-v2.0.3-rc1",
            "v1.4.2",
            "v1.4.2-rc4",
            "v1.4.2-rc3",
            "v1.4.2-rc2",
            "v1.4.2-rc1",
            "v1.4.1",
            "v1.4.0-rc4",
            "v1.4.0",
            "v1.4.0-rc3",
            "v1.4.0-rc2",
            "v1.4.0-rc1",
            "v1.3.6",
            "v1.3.6-rc5",
            "v1.3.6-rc4",
            "v1.3.6-rc3",
            "v1.3.6-rc2",
            "v1.3.6-rc1",
            "v1.3.5",
            "v1.3.5-rc5",
            "v1.3.5-rc4",
            "v1.3.5-rc3",
            "v1.3.5-rc2",
            "v1.3.5-rc1",
            "v1.3.4",
            "v1.3.4-rc1",
            "v1.3.3",
            "v1.3.2",
            "v1.3.2-rc3",
            "v1.3.2-rc2",
            "v1.3.2-rc1",
            "v1.3.1",
            "v1.3.0",
            "v1.3.0-rc12",
            "v1.3.0-rc11",
            "v1.3.0-rc10",
            "1.3.0-rc10",
            "v1.3.0-rc9",
            "v1.3.0-rc8",
            "v1.3.0-rc7",
            "v1.3.0-rc6",
            "v1.3.0-rc5",
            "v1.3.0-rc4",
            "v1.3.0-rc3",
            "v1.3.0-rc2",
            "v1.3.0-rc1",
            "v1.2.1",
            "v1.2.0",
            "v1.1.12",
            "v1.1.11",
            "v1.1.10",
            "v1.1.9",
            "v1.1.8",
            "v1.1.7",
            "v1.1.7-rc4",
            "v1.1.7-rc3",
            "v1.1.7-rc2",
            "v1.1.7-rc1",
            "v1.1.6",
            "v1.1.6-rc5",
            "v1.1.6-rc4",
            "v1.1.6-rc3",
            "v1.1.6-rc2",
            "v1.1.6-rc1",
            "v1.1.5",
            "v1.1.4",
            "v1.1.4-rc1",
            "v1.1.3",
            "v1.1.3-rc1",
            "v1.1.2",
            "v1.1.1",
            "v1.0.0",
            "v1.0.0-rc1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.1",
            "v0.9.0",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.5.0",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34091.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.447609743Z",
      "provider": "osv",
      "references": [
        "https://github.com/kyverno/kyverno/releases/tag/v1.10.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34091.json",
        "https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-34091"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-285"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34091.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-34091",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492839,
  "published_at": "2023-06-01T16:24:53.92+00:00"
}